feat(docker): inject build commit into published PWA images

The Docker/PWA build path bypassed the Electron workflow's inject step,
so published images showed the plain version in About. Pass the commit
as a build arg and run the inject script before the PWA build; the
script no-ops when BUILD_COMMIT is empty, leaving local docker builds
unchanged.

Addresses Codex feedback on #1208.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/docker.yml

@@ -109,5 +109,7 @@ jobs:
                   push: ${{ steps.docker-meta.outputs.publish == 'true' }}
                   tags: ${{ steps.docker-meta.outputs.tags }}
                   platforms: ${{ steps.docker-meta.outputs.platforms }}
+                  build-args: |
+                      BUILD_COMMIT=${{ github.event.pull_request.head.sha || github.sha }}
                   cache-from: type=gha
                   cache-to: type=gha,mode=max,ignore-error=true

docker/Dockerfile

@@ -15,6 +15,11 @@ RUN corepack enable && pnpm install --frozen-lockfile --ignore-scripts
 
 COPY . .
 
+# CI passes the git commit so Settings > About shows "<version> (<sha>)";
+# the inject script is a no-op when BUILD_COMMIT is empty (local builds).
+ARG BUILD_COMMIT=""
+RUN node tools/build/inject-build-commit.mjs
+
 RUN pnpm nx build web --configuration=pwa
 RUN pnpm nx build web-backend